Formal GTM brain

Formal sells network proxies that enforce and audit human and AI agent access to enterprise systems and data.

category

Privileged access and AI agent security

market profile

  • text: Security teams need to control sensitive data access without blocking productive use of applications and AI.
  • text: Formal combines outbound endpoint controls and privileged access in one policy and audit plane.

personas

  • title: CISO or head of security
    pains:
    • Agents can expose sensitive data or credentials to external services
    • Needs auditable least privilege across users, agents and systems
  • title: Infrastructure security engineer
    pains:
    • Access controls vary across databases, APIs and cloud infrastructure
    • Credentials in agent sandboxes create exposure and complicate attribution
  • title: Platform engineering leader
    pains:
    • Developers and agents need production access without excessive manual friction
    • Sandbox egress and credentials need consistent controls

icp

  • text: Technology businesses handling sensitive customer data across production databases and APIs, including software and payroll platforms.
  • text: Organizations deploying coding agents in workstations or cloud sandboxes and managing access to private resources.

message pillars

  • text: Apply least privilege to both people and agents.
  • text: Govern egress from agent sandboxes.
  • text: Keep credentials outside the sandbox through proxy injection.
  • text: Share security controls across products.

objections

  • objection: Will the proxy work with our existing infrastructure?
    response: Review required database, cloud, API and Kubernetes integrations in a technical pilot.
  • objection: Will stricter controls slow engineers down?
    response: Pilot narrowly scoped policies and measure access friction alongside audit coverage.

competitors

  • name: Teleport
    why: Offers infrastructure access controls and privileged access management.
  • name: StrongDM
    why: Provides centralized access control for infrastructure and data resources.
  • name: CyberArk
    why: Established privileged access management provider competing for enterprise security budgets.

influencers

  • name: Mokhtar Bacha
    url: https://www.formal.ai/about/
    why: Founder and CEO explaining Formal's access-control approach.

keywords

  • AI agent security
  • privileged access management
  • AI data loss prevention
  • MCP gateway security
  • database access control
  • agent sandbox egress
  • AI coding agent security

voice

  • technical and specific
  • security-focused
  • direct

signals

  • text: A security team is deploying AI coding agents that can access sensitive infrastructure.
  • text: An organization is consolidating access controls and audit logs across private resources.

stack

  • Kubernetes
  • AWS
  • Azure
  • Google Cloud
  • Cursor
  • Claude Code
  • Codex

pricing

model: unknown

motion

sales_led

channels

  • technical content
  • customer case studies
  • website

confidence

medium

Founders

  • name: Mokhtar Bacha
    title: Founder
    role: Founder
    bio: At 17 Mokhtar Bacha became the youngest employee at ConsenSys, hired by Ethereum co-founder Joseph Lubin. There, he gained expertise in cryptography, consensus algorithms, and distributed systems. Mokhtar launched Formal in 2022 with the mission to secure the world's data. Today thanks to an incredible team, we are proud to secure the data of customers like Notion.com, Ramp.com, and Gusto.com

Back to YC companies